fix(audit): H2 audit-view dedupe, M3/M4 honest labels, M10 documenso DLQ alert

H2: audit-page view audit row was firing on every filter change. Now
deduped per-user via Redis SET NX with a 60s TTL, so heavy filter-
tweaking writes one self-reference per minute instead of dozens.

R2-M3: /admin landing card for Onboarding said "Initial-setup wizard
for fresh ports" — the page is a static checklist that even calls
itself "what this page will become". Relabelled to "Onboarding
checklist · Setup checklist for fresh ports (read-only references)."

R2-M4: same for Backup & Restore — landing card promised "on-demand
exports" while the page renders only docs. Relabelled to "Backup
posture + retention policy (read-only)."

R2-M10: documenso-void worker had no DLQ alert hook — a persistent
401/403 from Documenso retried until BullMQ exhausted attempts and
the failure disappeared into audit. Now on final-attempt failure
we notify all super-admins via createNotification with a deduplicating
key per documentId, surfacing the 'void manually in Documenso if
still active' actionable.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/queue/workers/documents.ts

@@ -46,8 +46,52 @@ export const documentsWorker = new Worker(
   },
 );
 
-documentsWorker.on('failed', (job, err) => {
+documentsWorker.on('failed', async (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Documents job failed');
+
+  // Final-attempt failure on documenso-void → notify all super admins
+  // so they can void the envelope manually in Documenso. Without this
+  // alert hook, a persistent 401/403 from Documenso retries until
+  // BullMQ exhausts attempts and the failure disappears into the
+  // audit log unnoticed.
+  if (job?.name === 'documenso-void' && job.attemptsMade >= (job.opts.attempts ?? 1)) {
+    try {
+      const { documentId, documensoId, portId } = (job.data ?? {}) as {
+        documentId?: string;
+        documensoId?: string;
+        portId?: string;
+      };
+      if (!documentId || !documensoId) return;
+      const { db } = await import('@/lib/db');
+      const { userProfiles } = await import('@/lib/db/schema/users');
+      const { createNotification } = await import('@/lib/services/notifications.service');
+      const { eq, and } = await import('drizzle-orm');
+
+      const superAdmins = await db
+        .select({ userId: userProfiles.userId })
+        .from(userProfiles)
+        .where(and(eq(userProfiles.isSuperAdmin, true), eq(userProfiles.isActive, true)));
+      // createNotification requires a portId; if the job didn't carry
+      // one we can't tag the notification — bail out cleanly.
+      if (!portId) return;
+      for (const admin of superAdmins) {
+        void createNotification({
+          portId,
+          userId: admin.userId,
+          type: 'system_alert',
+          title: 'Documenso void failed',
+          description: `Document ${documentId.slice(0, 8)}… could not be voided in Documenso after ${job.attemptsMade} attempts. Void manually in Documenso if still active.`,
+          link: `/admin/documents`,
+          entityType: 'document',
+          entityId: documentId,
+          dedupeKey: `doc:void_failed:${documentId}`,
+          cooldownMs: 0,
+        });
+      }
+    } catch (notifyErr) {
+      logger.error({ notifyErr }, 'Failed to alert super-admins of documenso-void DLQ');
+    }
+  }
 });
 
 attachWorkerAudit(documentsWorker, 'documents');